Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Predictable filename in /tmp #2217

Open
jsegitz opened this issue Oct 6, 2022 · 1 comment
Open

Predictable filename in /tmp #2217

jsegitz opened this issue Oct 6, 2022 · 1 comment

Comments

@jsegitz
Copy link

jsegitz commented Oct 6, 2022

In /usr/bin/powerline-daemon on non-linux systems:
33 USE_FILESYSTEM = not sys.platform.lower().startswith('linux')
a predictable filename is used in /tmp
438 if USE_FILESYSTEM:
439 address = '/tmp/powerline-ipc-%d'
that allows local attackers to take over the socket by racing with the check in check_existing.

This is also a (minor) information leak possibility.

Please move the socket to /run/user/

@pcxmac
Copy link

pcxmac commented Mar 31, 2023

thumbs up I think.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants